SeAuditHandleDuplication

VOID __stdcall SeAuditHandleDuplication(
        VOID *SourceHandle,
        VOID *NewHandle,
        _EPROCESS *SourceProcess,
        _EPROCESS *TargetProcess){
  __int64 v8; 
  __int64 v9; 
  unsigned __int8 *v10; 
  int v11; 
  UINT8 IsKernelHandle; 
  INT8 v13; 
  unsigned int v14; 
  _SE_ADT_PARAMETER_TYPE v15; 
  __int64 v16; 
  unsigned __int64 v17; 
  UINT8 v18; 
  __int64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  _SE_ADT_PARAMETER_TYPE v22; 
  unsigned int v23; 
  _QWORD SubjectContext[5]; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  memset(&SubjectContext[1], 0, 32);
  SeCaptureSubjectContext((INT64)&SubjectContext[1]);
  v8 = SubjectContext[3];
  v9 = SubjectContext[3];
  if( SubjectContext[1] )
    v9 = SubjectContext[1];
  v10 = **(unsigned __int8 ***)(v9 + 152);
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  v11 = v10[1];
  AuditParameters.CategoryId = 3;
  if( SubjectContext[1] )
    v8 = SubjectContext[1];
  *(_DWORD *)&AuditParameters.FlatSubCategoryId = 524411;
  AuditParameters.Parameters[0].Length = 4 * v11 + 8;
  AuditParameters.AuditId = 4690;
  AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
  AuditParameters.Parameters[2].Data[0] = *(_QWORD *)(v8 + 24);
  AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
  AuditParameters.Parameters[0].Address = v10;
  AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[1].Length = 32;
  AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
  AuditParameters.Parameters[2].Length = 8;
  AuditParameters.Parameters[3].Type = SeAdtParmTypePtr;
  AuditParameters.Parameters[3].Length = 8;
  IsKernelHandle = ObpIsKernelHandle(SourceHandle, 0);
  AuditParameters.Parameters[4].Type = v15;
  v17 = v16 ^ 0xFFFFFFFF80000000ui64;
  AuditParameters.Parameters[4].Length = v14;
  AuditParameters.Parameters[5].Type = v15;
  if( !IsKernelHandle )
    v17 = (unsigned __int64)SourceHandle;
  AuditParameters.Parameters[4].Data[0] = (unsigned __int64)SourceProcess->UniqueProcessId;
  AuditParameters.Parameters[5].Length = v14;
  AuditParameters.Parameters[3].Data[0] = v17 & 0xFFFFFFFFFFFFFFFCui64;
  v18 = ObpIsKernelHandle(NewHandle, v13);
  v21 = v20 ^ v19;
  AuditParameters.Parameters[6].Type = v22;
  AuditParameters.Parameters[6].Length = v23;
  if( !v18 )
    v21 = (unsigned __int64)NewHandle;
  AuditParameters.Parameters[6].Data[0] = (unsigned __int64)TargetProcess->UniqueProcessId;
  AuditParameters.ParameterCount = 7;
  AuditParameters.Parameters[5].Data[0] = v21 & 0xFFFFFFFFFFFFFFFCui64;
  SepAdtLogAuditRecord(&AuditParameters);
  SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)&SubjectContext[1]);
}

Referenced by: